Re: [rules-users] CEP Rule Help Needed
by Greg Barton
Ah, overlooked that second rule. Have you tried the overlap operator?
So, just to clarify, the purpose of the two rules should be:
SnortRule: If two Snort events that are not port scans of an open port on the same destination arrive more than 5 minutes apart, delete the earlier one.
SnortRuleRetract: If two Snort events that are not port scans of an open port on any two destinations arrive within 5 minutes of each other, delete the earlier one.
Have you tried removing the temporal operators completely, just for testing purposes? What happens? i.e.
"TimelessSnortRule"
$s1 : Snort( sig_name != "(portscan) Open Port") from entry-point "Correlator"
$s2 : Snort( sig_name != "(portscan) Open Port" , id != $s1.id, ip_dst == $s1.ip_dst) from entry-point "Correlator"
"TimelessSnortRuleRetract"
$s1 : Snort( sig_name != "(portscan) Open Port") from entry-point "Correlator"
$s2 : Snort ( sig_name != "(portscan) Open Port" , id != $s1.id) from entry-point "Correlator"
--- On Wed, 7/22/09, Nestor Tarin Burriel <nestabur(a)gmail.com> wrote:
> From: Nestor Tarin Burriel <nestabur(a)gmail.com>
> Subject: Re: [rules-users] CEP Rule Help Needed
> To: "Rules Users List" <rules-users(a)lists.jboss.org>
> Date: Wednesday, July 22, 2009, 1:47 PM
> Thanks Greg,
>
> As you can see in the code I sent, I have the 2
> implementations:
>
> "SnortRule"
>
> $s1 : Snort( sig_name !=
> "(portscan) Open Port") from entry-point
> "Correlator"
>
> $s2 : Snort( sig_name != "(portscan)
> Open Port" , id != $s1.id, ip_dst == $s1.ip_dst, this
> after [5m] $s1) from entry-point "Correlator"
>
>
> "SnortRuleRetract"
> $s1 : Snort( sig_name !=
> "(portscan) Open Port") from entry-point
> "Correlator"
> $s2 : Snort ( sig_name != "(portscan)
> Open Port" , id != $s1.id, this after [0m,5m] $s1) from
> entry-point "Correlator"
>
>
> and any of them are thrown
>
> ...
>
> 2009/7/22 Greg Barton <greg_barton(a)yahoo.com>
>
>
>
> Maybe this is a problem of language. Here's what you
> say the rule should do:
>
>
>
> 'After receiving a fact "MyModel" wich name
> != "aaa", if arrives another
>
> with same ip and different id after a
> period between 0 and 5 minutes the
>
> rule have to retract the last one and keep the first
> fact (the older one)'
>
>
>
> Which I would interpret as "Event 1 comes in, then
> event 2 comes in between 0 and 5 minutes later." Does
> that sound right?
>
>
>
> And here's the rule that you think fits the
> requirements:
>
>
>
> rule "SnortRule"
>
> salience 2
>
> dialect "mvel"
>
> when
>
> $s1 : Snort( sig_name != "(portscan) Open
> Port") from entry-point "Correlator"
>
> $s2 : Snort( sig_name != "(portscan) Open
> Port" , id != $s1.id, ip_dst == $s1.ip_dst, this
> after [5m] $s1) from entry-point "Correlator"
>
> then
>
> System.out.println("******************
> Snort Alert!!!!" + $s1.getData());
>
> retract($s1);
>
> end
>
>
>
> Check out the docs, though:
>
>
>
> https://hudson.jboss.org/hudson/job/drools/lastSuccessfulBuild/artifact/t...
>
>
>
>
> The after operator in this case would check that (5m <=
> $s2.startTimestamp - $s1.endTimeStamp <= +infinity).
>
>
>
> So the rule actually implements "Event 1 comes in,
> then event 2 happens at leat 5 minutes later."
>
>
>
> If you use the second argument of after I think it would
> work:
>
>
>
> $s2 : Snort( sig_name != "(portscan) Open Port" ,
> id != $s1.id, ip_dst == $s1.ip_dst, this
> after [0m,5m] $s1) from entry-point "Correlator"
>
>
>
> According to the docs this should check that (0m <=
> $s2.startTimestamp - $s1.endTimeStamp <= 5m).
>
>
>
> You could alternately use "overlaps". Place an
> @duration(5m) annotation on the Snort declaration and try
> this condition:
>
>
>
> $s2 : Snort( sig_name != "(portscan) Open Port" ,
> id != $s1.id, ip_dst == $s1.ip_dst, this
> overlaps $s1) from entry-point "Correlator"
>
>
>
>
>
>
>
>
>
>
>
>
>
> _______________________________________________
>
> rules-users mailing list
>
> rules-users(a)lists.jboss.org
>
> https://lists.jboss.org/mailman/listinfo/rules-users
>
>
>
>
> -----Inline Attachment Follows-----
>
> _______________________________________________
> rules-users mailing list
> rules-users(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/rules-users
>
15 years, 5 months
Webguided decision table and nested objects
by Wishing Carebear
Hello:
I have a facts objects with nested objects : example:
Employee
name
Address
street
city
Wondering if it is possible to use Webguided decision table at the nested
object level (in the above example Address.street)
Thanks,
cabear
15 years, 5 months
Re: [rules-users] CEP Rule Help Needed
by Greg Barton
Without @timestamp the event time is the insertion time.
--- On Thu, 7/23/09, PriyaKathan <nash.8103(a)gmail.com> wrote:
> From: PriyaKathan <nash.8103(a)gmail.com>
> Subject: Re: [rules-users] CEP Rule Help Needed
> To: "Rules Users List" <rules-users(a)lists.jboss.org>
> Date: Thursday, July 23, 2009, 12:37 AM
> Hi,
> I found one thing missing here...It
> is @timestamp in event declaration...
15 years, 5 months
Re: [rules-users] CEP Rule Help Needed
by Greg Barton
Maybe this is a problem of language. Here's what you say the rule should do:
'After receiving a fact "MyModel" wich name != "aaa", if arrives another
with same ip and different id after a period between 0 and 5 minutes the
rule have to retract the last one and keep the first fact (the older one)'
Which I would interpret as "Event 1 comes in, then event 2 comes in between 0 and 5 minutes later." Does that sound right?
And here's the rule that you think fits the requirements:
rule "SnortRule"
salience 2
dialect "mvel"
when
$s1 : Snort( sig_name != "(portscan) Open Port") from entry-point "Correlator"
$s2 : Snort( sig_name != "(portscan) Open Port" , id != $s1.id, ip_dst == $s1.ip_dst, this after [5m] $s1) from entry-point "Correlator"
then
System.out.println("****************** Snort Alert!!!!" + $s1.getData());
retract($s1);
end
Check out the docs, though:
https://hudson.jboss.org/hudson/job/drools/lastSuccessfulBuild/artifact/t...
The after operator in this case would check that (5m <= $s2.startTimestamp - $s1.endTimeStamp <= +infinity).
So the rule actually implements "Event 1 comes in, then event 2 happens at leat 5 minutes later."
If you use the second argument of after I think it would work:
$s2 : Snort( sig_name != "(portscan) Open Port" , id != $s1.id, ip_dst == $s1.ip_dst, this after [0m,5m] $s1) from entry-point "Correlator"
According to the docs this should check that (0m <= $s2.startTimestamp - $s1.endTimeStamp <= 5m).
You could alternately use "overlaps". Place an @duration(5m) annotation on the Snort declaration and try this condition:
$s2 : Snort( sig_name != "(portscan) Open Port" , id != $s1.id, ip_dst == $s1.ip_dst, this overlaps $s1) from entry-point "Correlator"
15 years, 5 months
Re: [rules-users] DSL matching return wrong DRL
by Matt Geis
The question has already been answered, but to help you understand how DSL expansion works, here's what happens.
1. The expander goes down the list and matches the first expression against all lines in your rules. So,
rule dsl2drl_1
when
Get month summer
then
Print months;
end
becomes
rule dsl2drl_1
when
$month: Month(); summer
then
Print months;
end
2. The expander tries to match the second expression, and fails.
3. The expander tries to match the third expression, and succeeds, leaving you with the following DRL.
rule dsl2drl_1
when
$month: Month(); summer
then
System.out.println("Month: " + $month.getId());;
end
Looking at the LHS of the rule, this will not compile.
Matt
15 years, 5 months
Re: [rules-users] CEP Rule Help Needed
by Greg Barton
--- On Wed, 7/22/09, Nestor Tarin Burriel <nestabur(a)gmail.com> wrote:
> So I dont understand why my CEP rules never fires ...
Ah, the eternal lament of the rules developer. :)
Have you tried removing conditions until it does fire?
15 years, 5 months
Re: [rules-users] optimization on a lot of simple rules
by Greg Barton
There's no reason why you have to process all of your rules at once, or in one way. For instance, if the processing of this large set of "what's the decision" rules depend on nothing else, there's no reason they can't be in their own ruleset and processed separately in a StatelessKnowledgeSession. The results can then be passed to the rest of the rules.
In addition, if you do have other rules, then your testing setup is unrealistic. (i.e. throwing in one instance of each type, processing the rules, then retracting them all.)
--- On Tue, 7/21/09, nesta <nesta.fdb(a)163.com> wrote:
> From: nesta <nesta.fdb(a)163.com>
> Subject: Re: [rules-users] optimization on a lot of simple rules
> To: rules-users(a)lists.jboss.org
> Date: Tuesday, July 21, 2009, 12:44 AM
>
> Agree, but I can't choose sequential mode for several
> reason.
> Sequential mode means StatelessKnowledgeSession.
> 1. every request needs to create a new session(working
> memory).
> 2. our ruleset has other rules.
> 3. with StatefulKnowledgeSession, some facts can be
> initialized before
> process the request.
> 4. Agenda is needed.
>
> Thanks very much.
>
>
> Greg Barton wrote:
> >
> >
> > Well, if your rules are going to be that simple, have
> you tried sequential
> > mode? If there's never any reaction to working
> memory changes you don't
> > need the rete network. You should get much
> better performance out of that
> > ruleset, and others like it, in sequential mode.
> >
> > See
> > http://downloads.jboss.com/drools/docs/5.0.1.26597.FINAL/drools-expert/ht...,
> > section "3.3.7.1. Sequential Mode"
> >
> > In a nutshell, the rete network is used for tracking
> and reacting to
> > changes in the objects inserted into working memory.
> (i.e. a rule fires,
> > changes a WM object, then other rules may be eligible
> to fire based on
> > that change.) If you're not going to be using that
> functionality you'd be
> > constructing and maintaining the rete for no
> reason.
> >
> > --- On Mon, 7/20/09, nesta <nesta.fdb(a)163.com>
> wrote:
> >
> >> From: nesta <nesta.fdb(a)163.com>
> >> Subject: Re: [rules-users] optimization on a lot
> of simple rules
> >> To: rules-users(a)lists.jboss.org
> >> Date: Monday, July 20, 2009, 10:13 PM
> >>
> >> I execute above test codes, with 100 rules running
> 1000
> >> times. In the same
> >> time, I profile the test codes.
> >> http://www.nabble.com/file/p24581025/profile.jpg
> >> The profile result shows that some methods execute
> 100,000
> >> times.
> >> In test codes,
> >> Service has two states, 0 or 1.
> >> Subscriber has two states, 0 or 1.
> >>
> >> inserted facts:
> >> Product product = new Product(1, 1);
> >> Service service = new Service(1);
> >> Subscriber subscriber = new Subscriber(1);
> >>
> >> Service matches a half of total rules, namely 50.
> So is
> >> Subscriber.
> >> (50 + 50 ) * 1000 (running times) = 100,000
> >>
> >> I am confused what drools does. Is there a way to
> optimize
> >> it?
> >>
> >>
> >> Greg Barton wrote:
> >> >
> >> >
> >> > 1) Yes, if you eliminate joins in rules, you
> will have
> >> no joins in the
> >> > rete. This is self evident.
> >> >
> >> > 2) The way you have the rules structured,
> there is no
> >> relationship between
> >> > the joined objects. This will cause what's
> >> called a "cartesian join"
> >> > where all combinations of all instances of
> each object
> >> type are
> >> > instantiated. This can be very expensive,
> memory
> >> and CPU wise. You've
> >> > stated that there are only one instance of
> each object
> >> type in working
> >> > memory, but are you absolutely sure of
> that?
> >> Cartesian joins can easily
> >> > cause performance problems quite quickly.
> >> >
> >> > For instance, say you've got these objects in
> working
> >> memory:
> >> >
> >> > Subscriber(gender="male")
> >> > Subscriber(gender="female")
> >> > Service(name="ftp")
> >> > Service(name="http")
> >> > Product(id=1)
> >> > Product(id=2)
> >> > Product(id=3)
> >> >
> >> > After inserting a Decision into working
> memory, the
> >> rule will fire 2*2*3
> >> > times. (#Subscribers * #Services *
> #Products)
> >> This is by design. Is this
> >> > what you want?
> >> >
> >> > 3) Do you really need the 'Subscriber(gender
> == "male"
> >> or "female")' term?
> >> > Why not just 'Subscriber()'? Are you
> classifying
> >> transgendered or
> >> > nonhuman subscribers in your system?
> >> >
> >> > --- On Mon, 7/20/09, nesta <nesta.fdb(a)163.com>
> >> wrote:
> >> >
> >> >> From: nesta <nesta.fdb(a)163.com>
> >> >> Subject: Re: [rules-users] optimization
> on a lot
> >> of simple rules
> >> >> To: rules-users(a)lists.jboss.org
> >> >> Date: Monday, July 20, 2009, 10:22 AM
> >> >>
> >> >> I want to test the matching performance
> of drools.
> >> As I
> >> >> mentioned that there
> >> >> are a lot of rules and the rule is
> like:
> >> >> rule 1
> >> >> when
> >> >> Decision()
> >> >> Subscriber(gender ==
> >> >> "male" or "female")
> >> >> Service(name ==
> >> >> "ftp" or "http")
> >> >> Product(id == 1)
> >> >> ......
> >> >> then
> >> >> end
> >> >>
> >> >> After test, more condition elements under
> when,
> >> more time
> >> >> needs to execute
> >> >> the test.
> >> >> for example
> >> >> Location ( location == "home" or
> "office")
> >> >> and so on.
> >> >> So I worry about the matching performance
> with
> >> drools.
> >> >>
> >> >> I found that a lot of JoinNodes would be
> executed
> >> in
> >> >> runtime. I mean if
> >> >> there is 1000 rules, there will be a lot
> of
> >> JoinNodes
> >> >> (There are at least
> >> >> 1000 JoinNodes between Decision and
> Product ). And
> >> it
> >> >> exactly affects the
> >> >> execution performance.
> >> >>
> >> >> As you know, Decision, Product, Servcie
> and so on
> >> are plan
> >> >> Java classes. If
> >> >> I define all of attributes of above
> classes in one
> >> class
> >> >> named WholeFact,
> >> >> only one Java Type, there is no mentioned
> issue.
> >> >>
> >> >> With WholeFact class, the rule will be
> changed as
> >> follows:
> >> >> rule 1
> >> >> when
> >> >> WholeFact(
> >> >> subscriberGender == "male" or "female",
> >> >>
> >> >> serviceName
> >> >> == "ftp" or "http",
> >> >>
> >> >>
> >> >> productId == 1 or 2 or 3 ...
> >> >> )
> >> >> then
> >> >> end
> >> >>
> >> >>
> >> >> Greg Barton wrote:
> >> >> >
> >> >> >
> >> >> > Now this finally rises to something
> that
> >> needs rules.
> >> >> :) In all of the
> >> >> > previous examples you've given you
> could just
> >> have a
> >> >> > Map<ProductKey,Handler> where
> the
> >> Handler looks
> >> >> like this:
> >> >> >
> >> >> > interface Handler {
> >> >> > void handle(Product product,
> Decision
> >> >> decision);
> >> >> > }
> >> >> >
> >> >> > ...and the ProductKey consists of
> properties
> >> that
> >> >> uniquely identify how
> >> >> > the Product is handled. So, on
> it's own,
> >> that
> >> >> functionality did not
> >> >> > require rules.
> >> >> >
> >> >> > However, now that you've introduced
> more
> >> complex
> >> >> decisions, with varying
> >> >> > data, to affect the Decision for
> each
> >> Property type,
> >> >> rules are more
> >> >> > appropriate.
> >> >> >
> >> >> > Is there any reason why you only
> have one of
> >> each
> >> >> object type in memory at
> >> >> > one time? Maybe if you state more
> of the
> >> problem
> >> >> requirements we can help
> >> >> > you better.
> >> >> >
> >> >> > --- On Mon, 7/20/09, nesta <nesta.fdb(a)163.com>
> >> >> wrote:
> >> >> >
> >> >> >> From: nesta <nesta.fdb(a)163.com>
> >> >> >> Subject: Re: [rules-users]
> optimization
> >> on a lot
> >> >> of simple rules
> >> >> >> To: rules-users(a)lists.jboss.org
> >> >> >> Date: Monday, July 20, 2009,
> 4:14 AM
> >> >> >>
> >> >> >> Thanks very much.
> >> >> >> But if for every rule, there is
> one
> >> algorithm or
> >> >> discount
> >> >> >> which means that
> >> >> >> result has nothing related with
> Product's
> >> id and
> >> >> usage. I
> >> >> >> can't merge all
> >> >> >> rules in one rule. At the same
> time,
> >> besides
> >> >> Product and
> >> >> >> Decision fact type,
> >> >> >> there are more fact types.
> >> >> >> For example:
> >> >> >> rule 1
> >> >> >> when
> >> >> >> Decision()
> >> >> >> Subscriber(gender
> ==
> >> >> >> "male" or "female")
> >> >> >> Service(name ==
> >> >> >> "ftp" or "http")
> >> >> >> Product(id == 1)
> >> >> >> ......
> >> >> >> then
> >> >> >> ......
> >> >> >> end
> >> >> >> rule 2
> >> >> >> when
> >> >> >> Decision()
> >> >> >> Subscriber(gender
> ==
> >> >> >> "male" or "female")
> >> >> >> Service(name ==
> >> >> >> "ftp" or "http")
> >> >> >> Product(id == 2)
> >> >> >> ......
> >> >> >> then
> >> >> >> ......
> >> >> >> end
> >> >> >>
> >> >> >> .....
> >> >> >> .....
> >> >> >>
> >> >> >> In this scenario, if there are
> 1000
> >> rules, there
> >> >> will
> >> >> >> be a lot of JoinNode.
> >> >> >> But in runtime, there is only
> one
> >> Decision
> >> >> instance, one
> >> >> >> Subscriber instance
> >> >> >> and Service instance.
> >> >> >>
> >> >> >> If I define all data in one fact
> type, I
> >> think
> >> >> that there
> >> >> >> are not a lot of
> >> >> >> JoinNodes.
> >> >> >>
> >> >> >> Is there any other method?
> >> >> >>
> >> >> >>
> >> >> >>
> >> >> >> Wolfgang Laun-2 wrote:
> >> >> >> >
> >> >> >> > Well, what is the realtion
> between
> >> id, usage
> >> >> and the
> >> >> >> result that's to be
> >> >> >> > stored in a Decision or a
> global?
> >> >> >> >
> >> >> >> > Typically, such rules could
> be
> >> written as
> >> >> >> >
> >> >> >> > rule x
> >> >> >> > no-loop true
> >> >> >> > when
> >> >> >> > $d : Decision()
> >> >> >> > $p :Product( id ==
> 1, $usage
> >> :
> >> >> >> usage )
> >> >> >> > then
> >> >> >> > compute/store
> value,
> >> depending
> >> >> >> on the formula for id == 1
> (using
> >> >> >> > usage)
> >> >> >> > end
> >> >> >> > // similar rule for id ==
> 2,3,...
> >> >> >> >
> >> >> >> > If value is a
> straightforward
> >> function of id
> >> >> (and
> >> >> >> usage), then implement a
> >> >> >> > function compValue and use
> a single
> >> rule,
> >> >> e.g.:
> >> >> >> >
> >> >> >> > rule x
> >> >> >> > no-loop true
> >> >> >> > when
> >> >> >> > $d : Decision()
> >> >> >> > Product( $id : id,
> $usage :
> >> >> >> usage)
> >> >> >> > then
> >> >> >> > modify $d value to
> compValue(
> >> $id,
> >> >> $usage
> >> >> >> )
> >> >> >> >
> >> >> >> > Distinguishing all
> individual
> >> combinations of
> >> >> id and
> >> >> >> usage on the LHS
> >> >> >> > seems
> >> >> >> > excessive.
> >> >> >> >
> >> >> >> > The ordering of CEs also
> affects
> >> execution
> >> >> times.
> >> >> >> >
> >> >> >> > -W
> >> >> >> >
> >> >> >> > On 7/20/09, nesta <nesta.fdb(a)163.com>
> >> >> >> wrote:
> >> >> >> >>
> >> >> >> >>
> >> >> >> >> In this scenario, there
> are
> >> 1000
> >> >> products,
> >> >> >> different product has
> >> >> >> >> different
> >> >> >> >> price, besides this,
> the price
> >> is
> >> >> affected by
> >> >> >> usage. I want to use
> >> >> >> >> Product.id to match the
> rules.
> >> >> >> >>
> >> >> >> >> As you mentioned "The
> crude
> >> duplication
> >> >> of rules
> >> >> >> where only the constant
> >> >> >> >> to
> >> >> >> >> be matched with
> >> >> >> >> Product.id varies can,
> most
> >> likely, be
> >> >> avoided."
> >> >> >> >>
> >> >> >> >> How to avoid it in
> this
> >> scenario?
> >> >> >> >>
> >> >> >> >>
> >> >> >> >> Wolfgang Laun-2 wrote:
> >> >> >> >> >
> >> >> >> >> > It's difficult to
> suggest
> >> an
> >> >> optimized form
> >> >> >> for your rules 1-infinity,
> >> >> >> >> > since
> >> >> >> >> > we do not know
> what you
> >> want to
> >> >> achieve.
> >> >> >> >> >
> >> >> >> >> > The crude
> duplication of
> >> rules where
> >> >> only the
> >> >> >> constant to be matched
> >> >> >> >> with
> >> >> >> >> > Product.id varies
> can, most
> >> likely,
> >> >> be
> >> >> >> avoided.
> >> >> >> >> >
> >> >> >> >> > -W
> >> >> >> >> >
> >> >> >> >> >
> >> >> >> >> >
> >> >> >> >> > On Sun, Jul 19,
> 2009 at
> >> 3:15 PM,
> >> >> nesta <nesta.fdb(a)163.com>
> >> >> >> wrote:
> >> >> >> >> >
> >> >> >> >> >>
> >> >> >> >> >> Hi,
> >> >> >> >> >>
> >> >> >> >> >> I am a newbie
> in
> >> drools. There
> >> >> are a lot
> >> >> >> of simple rules in a
> >> >> >> >> scenario.
> >> >> >> >> >> For example
> >> >> >> >> >> rule 1
> >> >> >> >> >> when
> >> >> >> >> >>
> Product( id
> >> >> >> ==1, usage == 1)
> >> >> >> >> >>
> $decision :
> >> >> >> Decision()
> >> >> >> >> >> then
> >> >> >> >> >>
> >> >> >> $decision.setValue(1);
> >> >> >> >> >> end
> >> >> >> >> >>
> >> >> >> >> >> rule 2
> >> >> >> >> >> when Product(
> id ==2,
> >> usage ==
> >> >> 1)
> >> >> >> >> >> $decision :
> >> Decision()
> >> >> >> >> >> rule 3
> >> >> >> >> >> when Product(
> id ==3,
> >> usage ==
> >> >> 1)
> >> >> >> >> >> $decision :
> >> Decision()
> >> >> >> >> >> rule 4
> >> >> >> >> >> when Product(
> id ==4,
> >> usage ==
> >> >> 1)
> >> >> >> >> >> $decision :
> >> Decision()
> >> >> >> >> >> rule 5
> >> >> >> >> >> when Product(
> id ==5,
> >> usage ==
> >> >> 1)
> >> >> >> >> >> $decision :
> >> Decision()
> >> >> >> >> >> ......
> >> >> >> >> >>
> >> >> >> >> >> I have a
> Product fact
> >> whose id =
> >> >> 5 and
> >> >> >> usage = 1, in my first
> >> >> >> >> thinking,
> >> >> >> >> >> only
> >> >> >> >> >> rule 5 is
> matched,
> >> there should
> >> >> be not
> >> >> >> much more different between 1
> >> >> >> >> rule
> >> >> >> >> >> and a lot of
> rules in
> >> runtime.
> >> >> >> >> >>
> >> >> >> >> >> But the result
> shows
> >> that they
> >> >> are
> >> >> >> different. More rules will cost
> >> >> >> >> more
> >> >> >> >> >> time. If there
> are 1
> >> thousand
> >> >> rules, some
> >> >> >> Node and Sink will execute 1
> >> >> >> >> >> thousand
> times.
> >> >> >> >> >>
> >> >> >> >> >> My question is
> how to
> >> optimize
> >> >> this
> >> >> >> scenario?
> >> >> >> >> >> --
> >> >> >> >> >> View this
> message in
> >> context:
> >> >> >> >> >>
> >> >> >> >>
> >> >> >>
> >> >>
> >> http://www.nabble.com/optimization-on-a-lot-of-simple-rules-tp24556724p24...
> >> >> >> >> >> Sent from the
> drools -
> >> user
> >> >> mailing list
> >> >> >> archive at Nabble.com.
> >> >> >> >> >>
> >> >> >> >> >>
> >> >> >>
> >> _______________________________________________
> >> >> >> >> >> rules-users
> mailing
> >> list
> >> >> >> >> >> rules-users(a)lists.jboss.org
> >> >> >> >> >> https://lists.jboss.org/mailman/listinfo/rules-users
> >> >> >> >> >>
> >> >> >> >> >
> >> >> >> >> >
> >> >> >>
> >> _______________________________________________
> >> >> >> >> > rules-users
> mailing list
> >> >> >> >> > rules-users(a)lists.jboss.org
> >> >> >> >> > https://lists.jboss.org/mailman/listinfo/rules-users
> >> >> >> >> >
> >> >> >> >> >
> >> >> >> >>
> >> >> >> >> --
> >> >> >> >> View this message in
> context:
> >> >> >> >>
> >> >> >>
> >> >>
> >> http://www.nabble.com/optimization-on-a-lot-of-simple-rules-tp24556724p24...
> >> >> >> >> Sent from the drools -
> user
> >> mailing list
> >> >> archive
> >> >> >> at Nabble.com.
> >> >> >> >>
> >> >> >> >>
> >> >>
> _______________________________________________
> >> >> >> >> rules-users mailing
> list
> >> >> >> >> rules-users(a)lists.jboss.org
> >> >> >> >> https://lists.jboss.org/mailman/listinfo/rules-users
> >> >> >> >>
> >> >> >> >
> >> >> >> >
> >> >>
> _______________________________________________
> >> >> >> > rules-users mailing list
> >> >> >> > rules-users(a)lists.jboss.org
> >> >> >> > https://lists.jboss.org/mailman/listinfo/rules-users
> >> >> >> >
> >> >> >> >
> >> >> >>
> >> >> >> --
> >> >> >> View this message in context:
> >> >> >>
> >> >>
> >> http://www.nabble.com/optimization-on-a-lot-of-simple-rules-tp24556724p24...
> >> >> >> Sent from the drools - user
> mailing list
> >> archive
> >> >> at
> >> >> >> Nabble.com.
> >> >> >>
> >> >> >>
> >> _______________________________________________
> >> >> >> rules-users mailing list
> >> >> >> rules-users(a)lists.jboss.org
> >> >> >> https://lists.jboss.org/mailman/listinfo/rules-users
> >> >> >>
> >> >> >
> >> >> >
> >> >> >
> >> >> >
> >> >> >
> >> _______________________________________________
> >> >> > rules-users mailing list
> >> >> > rules-users(a)lists.jboss.org
> >> >> > https://lists.jboss.org/mailman/listinfo/rules-users
> >> >> >
> >> >> >
> >> >>
> >> >> --
> >> >> View this message in context:
> >> >>
> >> http://www.nabble.com/optimization-on-a-lot-of-simple-rules-tp24556724p24...
> >> >> Sent from the drools - user mailing list
> archive
> >> at
> >> >> Nabble.com.
> >> >>
> >> >>
> >> >>
> _______________________________________________
> >> >> rules-users mailing list
> >> >> rules-users(a)lists.jboss.org
> >> >> https://lists.jboss.org/mailman/listinfo/rules-users
> >> >>
> >> >
> >> >
> >> >
> >> >
> >> >
> _______________________________________________
> >> > rules-users mailing list
> >> > rules-users(a)lists.jboss.org
> >> > https://lists.jboss.org/mailman/listinfo/rules-users
> >> >
> >> >
> >>
> >> --
> >> View this message in context:
> >> http://www.nabble.com/optimization-on-a-lot-of-simple-rules-tp24556724p24...
> >> Sent from the drools - user mailing list archive
> at
> >> Nabble.com.
> >>
> >>
> >> _______________________________________________
> >> rules-users mailing list
> >> rules-users(a)lists.jboss.org
> >> https://lists.jboss.org/mailman/listinfo/rules-users
> >>
> >
> >
> >
> >
> > _______________________________________________
> > rules-users mailing list
> > rules-users(a)lists.jboss.org
> > https://lists.jboss.org/mailman/listinfo/rules-users
> >
> >
>
> --
> View this message in context: http://www.nabble.com/optimization-on-a-lot-of-simple-rules-tp24556724p24...
> Sent from the drools - user mailing list archive at
> Nabble.com.
>
>
> _______________________________________________
> rules-users mailing list
> rules-users(a)lists.jboss.org
> https://lists.jboss.org/mailman/listinfo/rules-users
>
15 years, 5 months
CEP Rule Help Needed
by nestabur
Hi all,
I'm getting crazy trying to create a CEP rule in droos 5.0.1 :(
The rule is:
===============
rule "RetractOlderFacts"
dialect "mvel"
when
$s1 : MyModel( name != "aaa") from entry-point "MyEntryPoint"
$s2 : MyModel ( name != "aaa" , id != $s1.id, ip == $s1) and MyModel (
this after [0m,5m] $s1) from entry-point "MyEntryPoint"
then
retract($s2);
System.out.println(" ********* Retracting from WM");
end
===============
The scenario is:
"After receiving a fact "MyModel" wich name != "aaa", if arrives another
with same ip and different id after a period between 0 and 5 minutes the
rule have to retract the last one and keep the first fact (the older one)"
After receiving hundred and hundred of facts via JMS that may match with the
rule condition, the rule never throws!
is the rule correct?
could the problem be at the rule engine implementation?
Could anyone hel me please?
Thanks in advance,
nestabur
--
View this message in context: http://www.nabble.com/CEP-Rule-Help-Needed-tp24591289p24591289.html
Sent from the drools - user mailing list archive at Nabble.com.
15 years, 5 months
DSL matching return wrong DRL
by Luis Silva
Hi everebody, I've a quiestion about DSL:
I have the next DSL:
[when][]Get month = $month: Month();
[when][]Get month summer = $month: Month(id in (6,7,8,9));
[then][]Print months = System.out.println("Month: " + $month.getId());
And the next Rule:
rule dsl2drl_1
when
Get month summer
then
Print months;
end
When the ksession fires we get the error: DSLR: [10,20]: [ERR 101] Line
10:20 no viable alternative at input 'summer' in rule dsl2drl_1
But It works ok if I change the first DSL from :
- Get month = $month: Month();
to ('s' is added in 'month' word) :
- Get months = $month: Month();
What could be the problem? I use Drools 5.0.0.CR1 and jdk1.5.0_16
I attached a small project for test.
Thanks
--
Luis Enrique Silva Valdivieso
Cel. 00 51 1 991546707
Casa 00 51 1 4476616
15 years, 5 months
Problem : Run Drool Application From Command Prompt
by Pankaj.Jain＠lntinfotech.com
Hi
I am trying to integrate Drool with ofbiz and run application from command
prompt. In one way I have integrated it properly and I am able to run it
successfully.
Code : Which I was using initially
KnowledgeBuilder kbuilder = KnowledgeBuilderFactory.newKnowledgeBuilder();
or
PackageBuilderConfiguration cfg = new PackageBuilderConfiguration();
KnowledgeBuilder kbuilder = KnowledgeBuilderFactory.newKnowledgeBuilder();
Exception I got :
org.drools.RuntimeDroolsException: Unable to load dialect
'org.drools.rule.builder.dialect.java.JavaDialectConfiguration:java
:org.drools.rule.builder.dialect.java.JavaDialectConfiguration'
at
org.drools.compiler.PackageBuilderConfiguration.addDialect(PackageBuilderConfiguration.java:274)
at
org.drools.compiler.PackageBuilderConfiguration.buildDialectConfigurationMap(PackageBuilderConfiguration.java:259)
at
org.drools.compiler.PackageBuilderConfiguration.init(PackageBuilderConfiguration.java:176)
at
org.drools.compiler.PackageBuilderConfiguration.<init>(PackageBuilderConfiguration.java:153)
at org.drools.compiler.PackageBuilder.<init>(PackageBuilder.java:242)
.
.
.
Caused by: java.lang.NullPointerException
at
org.drools.rule.builder.dialect.java.JavaDialectConfiguration.setCompiler(JavaDialectConfiguration.java:92)
at
org.drools.rule.builder.dialect.java.JavaDialectConfiguration.init(JavaDialectConfiguration.java:55)
at
org.drools.compiler.PackageBuilderConfiguration.addDialect(PackageBuilderConfiguration.java:270
Problem I found :
In the class JavaDialectConfiguration in jar file drools-compiler.jar
there is a method named "setCompliler", in this method Null Pointer
Exception was coming.
Solution I provided :
In my application I created my custom class CustomJavaDialectConfiguration
by extending to class JavaDialectConfiguration, In this class I overrided
the method setCompiler. My method was exactly same as that of method
setCompiler in JavaDialectConfiguration . To call my dialect class I also
overrided the method "addDialect" of PackageBuilderConfiguration class .
For that I created class CustomPackageBuilderConfiguration by extending to
PackageBuilderConfiguration.
after that I wrote the code:
PackageBuilderConfiguration cfg = new CustomPackageBuilderConfiguration();
KnowledgeBuilder kbuilder =
KnowledgeBuilderFactory.newKnowledgeBuilder(cfg);
Now application is running perfectly fine from both eclipse and command
prompt without any exception.
I want to know as my overrided method "setCompiler" was exactly same then
why I had to override method, and In original code (ie in
drools-compiler.jar file) why it was giving exception ??? Was that due
to class lader or something else ?? Please do help in this regard ....
Thanks & Regards:
Pankaj Jain | L&T infotech |Navi Mumbai
Mobile: +91 9920218945
Email : pankaj.jain(a)lntinfotech.com
www.Lntinfotech.com
"Whatever the mind of man can conceive & believe, it can achieve."
Larsen & Toubro Infotech Ltd.
www.Lntinfotech.com
This Document is classified as:
L&T Infotech Proprietary L&T Infotech Confidential L&T Infotech
Internal Use Only L&T Infotech General Business
This Email may contain confidential or privileged information for the
intended recipient (s) If you are not the intended recipient, please do
not use or disseminate the information, notify the sender and delete it
from your system.
______________________________________________________________________
15 years, 5 months
